DevForce Community Forum : Mixed http/https content http://www.ideablade.com/forum/ This is an XML content feed of; DevForce Community Forum : DevForce 2010 : Mixed http/https content Wed, 29 Jul 2026 20:30:58 -700 Mon, 16 May 2011 14:13:03 -700 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 9.69 360 www.ideablade.com/forum/RSS_post_feed.asp?TID=2666 DevForce Community Forum http://www.ideablade.com/forum/forum_images/IdeaBlade_logo_tm.png http://www.ideablade.com/forum/ Mixed http/https content : Greg, I'm glad to hear... http://www.ideablade.com/forum/forum_posts.asp?TID=2666&PID=10704#10704 Author: robertg
Subject: 2666
Posted: 16-May-2011 at 2:13pm

Greg,
 
I'm glad to hear that! Do you mind sharing what the problem was, in case we see any other developers hit the same snag?
 
-- Robert
]]> Mon, 16 May 2011 14:13:03 -700 http://www.ideablade.com/forum/forum_posts.asp?TID=2666&PID=10704#10704 Mixed http/https content : Thanks very much Robert, you... http://www.ideablade.com/forum/forum_posts.asp?TID=2666&PID=10672#10672 Author: gregweb
Subject: 2666
Posted: 12-May-2011 at 7:28pm

Thanks very much Robert, you helped me resolve this issue.
 
Greg
]]> Thu, 12 May 2011 19:28:30 -700 http://www.ideablade.com/forum/forum_posts.asp?TID=2666&PID=10672#10672 Mixed http/https content : Oh, that makes perfect sense.... http://www.ideablade.com/forum/forum_posts.asp?TID=2666&PID=10662#10662 Author: robertg
Subject: 2666
Posted: 12-May-2011 at 10:59am

Oh, that makes perfect sense. I can only come up with a couple of ideas offhand, and they don't seem perfect. These are:

* You could encrypt your data before transmission from your server to the client, and decrypt it in the client for display. Back when I used to be in the ISP business, we would discuss this as encrypting the payload, rather than the transmission. The advantage of this is that you then don't have to use HTTPS to secure your data, and thus can add in sources from other locations which are insecure. The disadvantages are that data encryption requires a lot more system resources than channel encryption, and that you would become responsible for your own security, rather than relying on a standard.

* Rather than retrieving third-party data directly, you could run a proxy on your server which retrieves them, and then serves them across HTTPS to your client. I'm sure you can see the drawbacks of this right away too: increased bandwidth utilization, the false impression that served resources are "from" your server, increased exposure of your server to potential attacks.

I'm really surprised that setting your web client permissions to allow both secure and insecure components within a single page isn't being respected by Silverlight. What mechanism are you using to retrieve these images? I wonder if that mechanism is automatically trying to retrieve them via SSL because the main page transmission was in SSL. Could you debug the app, and see if the URI for these images is different, depending on whether you are using SSL or not?
]]> Thu, 12 May 2011 10:59:28 -700 http://www.ideablade.com/forum/forum_posts.asp?TID=2666&PID=10662#10662 Mixed http/https content : Hi Robert,The html that is... http://www.ideablade.com/forum/forum_posts.asp?TID=2666&PID=10647#10647 Author: gregweb
Subject: 2666
Posted: 11-May-2011 at 1:54pm

Hi Robert,
 
The html that is being displayed is an HTML Email.  So, for example, I have my Gmail account hooked up to SecuraEmail.com which is the SL app.
 
So when I open up an email, there are often links to external images.  If I get an html email from RedBox, it is going to have images which need to be downloaded from the RedBox site.  These download just fine if I am not running over https.  But to encrypt the DevForce data that goes across the wire, I use https.  But using the https then prevents the images from downloading.
 
If it is an embedded image in the email, it is a different story as I do convert the image to a ByteArray and then download it via DevForce and it displays just fine.  But I have no control over linked html content that comes in via an email.
 
That is why I was wondering if there was a way to encrypt the DevForce data without having to use https.
 
Greg
]]> Wed, 11 May 2011 13:54:03 -700 http://www.ideablade.com/forum/forum_posts.asp?TID=2666&PID=10647#10647 Mixed http/https content : Greg, What are you using to... http://www.ideablade.com/forum/forum_posts.asp?TID=2666&PID=10646#10646 Author: robertg
Subject: 2666
Posted: 11-May-2011 at 1:40pm

Greg,
 
What are you using to retrieve the images, and where are you retrieving them from? Are you getting them from the same server that' doing the server-side of your application, or is it a different one? Have you considered converting the images to ByteArray, storing them in your database, and then accessing them as entities which you can convert back to images for display?
 
Yours,
Robert
]]> Wed, 11 May 2011 13:40:37 -700 http://www.ideablade.com/forum/forum_posts.asp?TID=2666&PID=10646#10646 Mixed http/https content : I have an app which uses the... http://www.ideablade.com/forum/forum_posts.asp?TID=2666&PID=10636#10636 Author: gregweb
Subject: 2666
Posted: 11-May-2011 at 7:25am

I have an app which uses the C1 RichTextBox to display HTML. When there is an external image, it fetches it just fine.
However, in order to secure the data, I switched over to using https. This works great as far as the data is concerned. However, the image fetch for external images then no longer works.
My first thought on this was to check the IE settings for Mixed Content, but this is already enabled.
So am trying to resolve how to allow mixed content.
Any suggestions? Maybe a way of encrypting the data without using https?
Greg
]]> Wed, 11 May 2011 07:25:48 -700 http://www.ideablade.com/forum/forum_posts.asp?TID=2666&PID=10636#10636